yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2024-12-24 11:55:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

x86: fix SS selector in SYSRET

Browse source 
According to my reading of the Intel documentation, the SYSRET instruction
is supposed to force the RPL bits of the %ss register to 3 when returning
to user mode. The actual sequence is:

SS.Selector <-- (IA32_STAR[63:48]+8) OR 3; (* RPL forced to 3 *)

However, the code in helper_sysret() leaves them at 0 (in other words, the "OR
3" part of the above sequence is missing). It does set the privilege level
bits of %cs correctly though.

This has caused me trouble with some of my VxWorks development: code that runs
okay on real hardware will crash on QEMU, unless I apply the patch below.

Backports commit ac57622985220de064059971f9ccb00905e9bd04 from qemu
This commit is contained in:
Paolo Bonzini 2018-02-12 16:03:11 -05:00 committed by Lioncash
parent fc39930347
commit aed1972af9
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
qemu/target-i386/seg_helper.c
View file

@ -1044,7 +1044,7 @@ void helper_sysret(CPUX86State *env, int dflag)
DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
env->eip = (uint32_t)env->regs[R_ECX]; env->eip = (uint32_t)env->regs[R_ECX];
} }
cpu_x86_load_seg_cache(env, R_SS, selector + 8, cpu_x86_load_seg_cache(env, R_SS, (selector + 8) | 3,
0, 0xffffffff, 0, 0xffffffff,
DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
DESC_S_MASK | (3 << DESC_DPL_SHIFT) | DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
@ -1057,7 +1057,7 @@ void helper_sysret(CPUX86State *env, int dflag)
DESC_S_MASK | (3 << DESC_DPL_SHIFT) | DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
env->eip = (uint32_t)env->regs[R_ECX]; env->eip = (uint32_t)env->regs[R_ECX];
cpu_x86_load_seg_cache(env, R_SS, selector + 8, cpu_x86_load_seg_cache(env, R_SS, (selector + 8) | 3,
0, 0xffffffff, 0, 0xffffffff,
DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
DESC_S_MASK | (3 << DESC_DPL_SHIFT) | DESC_S_MASK | (3 << DESC_DPL_SHIFT) |